CVE-2026-54541 Details

A denial-of-service vulnerability has been identified in Nimiq's Rust implementation of the Proof-of-Stake protocol, prior to version 1.6.0. The issue arises during state synchronization, where a malicious peer can crash a syncing node by sending a crafted TrieChunk proof. This proof contains two TrieProofNode values with identical keys, which causes a panic when the TrieProof verification process unconditionally unwraps a None value. The exploitation takes advantage of unverified network input, allowing the attacker to disrupt the victim's node without needing a valid cryptographic proof. Although the crash is temporary and the node will automatically restart and resynchronize, the vulnerability can still be exploited by any peer during the state sync process.

Users are advised to upgrade to Nimiq version 1.6.0 or later, where this vulnerability has been fixed. The updated version includes a validation in the TrieProofNode::child_index function that rejects equal-length keys, preventing the exploitation of this issue.